CVE-2025-40019-POC

CVE-2025-40019에 대한 개념 증명 CVE-2025-40019는 Encrypted Salt-Sector Initialization Vector 메커니즘crypto/essiv.c에서 Associated Authentication DataAAD 길이에 대한 검증이 초기화 벡터IV 크기와 비교하여 충분하지 않아, 메모리 경계를 넘어 접근하는 취약점입니다. 이 저장소에 제공된 코드는 단순한 버그 트리거이지만, 이 버그는 쉽게 악용될 수 있습니다. KernelCTF 항목 이 버그를 kernelctf 스프레드시트 여기에서...

cve-2026-31431-poc

CVE 2026-31431 POC This exploit takes advantage of a flaw in the length validation of authencesn in Linux, causing dirty pages to be written back to locations the user has no permission to access, resulting in privilege escalation. The attack principle is mainly based on this repo, with some...

EUVD-2026-87745

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' multimodal payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied...

AZL-102224 CVE-2026-92523 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

CVE-2026-92523

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

CVE-2026-63126

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or...

EUVD-2026-78802

FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKIDCOREDEVICEIOCOMPLETION responses to trigger reads past...

EUVD-2026-78064

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: mac80211 – Increase scanieslen for S1G. Currently, the S1G capability element is not taken into consideration when calculating scanieslen, which leads to a buffer length validation failure in the ieee80211prephwscan functio...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the ofmodalias function, we can pass the str and len parameters. This could lead to a kernel oops in vsnprintf, as the function only allows passing a NULL pointer when the length is also 0. Additionally, we need to filter out...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevents out-of-bounds stream writes by validating pos. The ksmbdvfsstreamwrite function did not validate whether the write offset pos was within the bounds of the existing stream data length vlen. If pos was greater than ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: cifs: Fixed a buffer overflow issue when parsing NFS reparse points. ReparseDataLength is the sum of the InodeType size and the DataBuffer size. To obtain the DataBuffer size, it is necessary to subtract the InodeType size fro...

Astra Linux – Vulnerability in Netty

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. In Netty io.netty:netty-codec-http2 before version 4.1.61.Final, there is a vulnerability that allows for request smuggling. This...

Astra Linux – Vulnerability in libpcap

The sf-pcapng.c file in libpcap before version 1.9.1 does not properly validate the PHB header length before allocating memory...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bridge: brndsend: Validates the lengths of ND options. The brndsend function checks the ND options based on the lengths provided for those options. A malformed option may cause the parser to progress beyond the calculated option...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/setmasked payload length The validateset function accepts OVSKEYATTRMPLS as a variable-sized payload for SET/SETMASKED actions. In action handling, OVS expects fixed-size MPLS key data struct...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Validating the PDU length before reading the SDU length in l2capecreddatarcv The l2capecreddatarcv function reads the SDU length field from skb-data using getunalignedle16, without first verifying that skb...

CVE-2026-23791

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver due to missing input length validation in color mode LUT parsing leads to kernel memory corruption and potentia...

Linux Distros Unpatched Vulnerability : CVE-2026-68497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to...

Linux Distros Unpatched Vulnerability : CVE-2026-89529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation...